Skip to content

Set up remote ad hoc builds #70396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mountiny merged 31 commits into from
Oct 16, 2025
Merged

Set up remote ad hoc builds #70396

Changes from all commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
99e9e89
add scaffold actions for remote adhocs
rinej Aug 25, 2025
0cbd691
Merge branch 'Migrate-rnef-to-rock' into set-up-remote-ad-hoc-builds
rinej Sep 9, 2025
59ded22
adjust change after rnef to rock refactor
rinej Sep 9, 2025
07fc01a
Merge branch 'main' into set-up-remote-ad-hoc-builds
rinej Sep 11, 2025
a2a8724
add ag-hoc flags to android
rinej Sep 11, 2025
6a73b5a
remove adhoc build on every merge to main
rinej Sep 16, 2025
1197873
adjust apps build urls
rinej Sep 16, 2025
ec40f06
Merge branch 'main' into set-up-remote-ad-hoc-builds
rinej Sep 16, 2025
04bcab5
fix lint for wokflow
rinej Sep 16, 2025
9b11a77
take base64 certificate from 1password
rinej Sep 18, 2025
bfce94a
adjust load credential naming
rinej Sep 18, 2025
7dc2e78
load additional credentials from 1Pass
rinej Sep 23, 2025
e73dea5
adjust android adhoc build to use file instead of base64
rinej Sep 29, 2025
caad4d5
adjust ios adhoc build to use files instead of base64
rinej Sep 29, 2025
e790d50
disable comment bot on testBuild
rinej Sep 29, 2025
38af96c
Merge branch 'main' into set-up-remote-ad-hoc-builds
rinej Oct 1, 2025
b91537a
fix: set github token in env only
rinej Oct 2, 2025
593f4c9
add custom keystore path to android testBuild
rinej Oct 7, 2025
c254cc6
remove keychain and certificate password in ios test build
rinej Oct 7, 2025
951391a
adjust keystore-path, use proper configuration name
rinej Oct 8, 2025
41cbd72
update certificates names on iOS
rinej Oct 8, 2025
9907c1c
add additional logging on android, support special characters on ios
rinej Oct 8, 2025
1aa38d3
add android param
rinej Oct 8, 2025
51da0c6
update ios actiob for special characters
rinej Oct 8, 2025
b5e786a
update rock action commit hash
rinej Oct 9, 2025
db547a7
add mapping for bundle IDs to provisioning profile names on ios,
rinej Oct 14, 2025
f04e89d
add absolute path when creating ExportOptions.plist
rinej Oct 14, 2025
6762c36
add fix with for downloading cache for ios
rinej Oct 15, 2025
d392e67
update android commit hash
rinej Oct 15, 2025
bb6d63e
use most recent ios action commit hash
rinej Oct 15, 2025
4ee45cd
Merge branch 'main' into set-up-remote-ad-hoc-builds
rinej Oct 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
134 changes: 74 additions & 60 deletions .github/workflows/testBuild.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ jobs:
needs: [prep, getMobileExpensifyPR, getMobileExpensifyRef]
runs-on: ubuntu-latest-xl
outputs:
S3_APK_PATH: ${{ steps.exportAndroidS3Path.outputs.S3_APK_PATH }}
ROCK_APK_PATH: ${{ steps.rock-remote-build-android.outputs.artifact-url }}
steps:
- name: Checkout
# v4
Expand Down Expand Up @@ -334,35 +334,25 @@ jobs:
ANDROID_UPLOAD_KEYSTORE_ALIAS: op://${{ vars.OP_VAULT }}/Repository-Secrets/ANDROID_UPLOAD_KEYSTORE_ALIAS
ANDROID_UPLOAD_KEY_PASSWORD: op://${{ vars.OP_VAULT }}/Repository-Secrets/ANDROID_UPLOAD_KEY_PASSWORD

- name: Build Android app
id: build
- name: Rock Remote Build - Android
id: rock-remote-build-android
uses: callstackincubator/android@1585a4a0b32801c26d2dae67a09f0df530df25c0 # v3
env:
ANDROID_UPLOAD_KEYSTORE_PASSWORD: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
ANDROID_UPLOAD_KEYSTORE_ALIAS: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }}
ANDROID_UPLOAD_KEY_PASSWORD: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
run: bundle exec fastlane android build_adhoc_hybrid

- name: Configure AWS Credentials
# v4
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
IS_HYBRID_APP: true
GITHUB_TOKEN: ${{ github.token }}
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Upload Android AdHoc build to S3
run: bundle exec fastlane android upload_s3
env:
S3_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY_ID }}
S3_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
S3_BUCKET: ad-hoc-expensify-cash
S3_REGION: us-east-1

- name: Export S3 path
id: exportAndroidS3Path
run: |
# $s3APKPath is set from within the Fastfile, android upload_s3 lane
echo "S3_APK_PATH=$s3APKPath" >> "$GITHUB_OUTPUT"
variant: 'Adhoc'
sign: true
re-sign: true
keystore-file: './upload-key.keystore'
keystore-store-file: 'upload-key.keystore'
keystore-store-password: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
keystore-key-alias: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }}
keystore-key-password: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
# Specify the path (relative to the Android source directory) where the keystore should be placed.
keystore-path: '../tools/buildtools/upload-key.keystore'
comment-bot: false
rock-build-extra-params: '--extra-params -PreactNativeArchitectures=arm64-v8a,x86_64'

@adhorodyski adhorodyski Sep 29, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we make sure these are still required? As far as I remember the default value is now the same.

@rinej rinej Sep 29, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the project’s Gradle setup, we’ve got all four architectures selected.
If we don’t want to build for the legacy one, I think we’ll still need to keep it. Do you know how we can verify that further?

@adhorodyski adhorodyski Sep 30, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No I think you're right, thanks for looking into it! Let's leave it as is.


iosHybrid:
name: Build and deploy iOS for testing
Expand All @@ -372,7 +362,7 @@ jobs:
DEVELOPER_DIR: /Applications/Xcode_26.0.app/Contents/Developer
runs-on: macos-15-xlarge
outputs:
IOS_PATH: ${{ steps.export-ios-path.outputs.IOS_PATH }}
ROCK_IOS_PATH: ${{ steps.rock-remote-build-ios.outputs.artifact-url }}
steps:
- name: Checkout
# v4
Expand Down Expand Up @@ -438,6 +428,7 @@ jobs:
# v1
uses: 1password/install-cli-action@143a85f84a90555d121cde2ff5872e393a47ab9f


- name: Load files from 1Password
env:
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
Expand All @@ -447,34 +438,57 @@ jobs:
op read "op://${{ vars.OP_VAULT }}/OldApp_AdHoc_Notification_Service/OldApp_AdHoc_Notification_Service.mobileprovision" --force --out-file ./OldApp_AdHoc_Notification_Service.mobileprovision
op read "op://${{ vars.OP_VAULT }}/New Expensify Distribution Certificate/Certificates.p12" --force --out-file ./Certificates.p12

- name: Build AdHoc app
run: bundle exec fastlane ios build_adhoc_hybrid

- name: Configure AWS Credentials
# v4
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1

- name: Upload AdHoc build to S3
run: bundle exec fastlane ios upload_s3
env:
S3_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY_ID }}
S3_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
S3_BUCKET: ad-hoc-expensify-cash
S3_REGION: us-east-1

- name: Export iOS path
id: export-ios-path
- name: Create ExportOptions.plist
run: |
content_ios="$(cat ./ios_paths.json)"
content_ios="${content_ios//'%'/'%25'}"
content_ios="${content_ios//$'\n'/'%0A'}"
content_ios="${content_ios//$'\r'/'%0D'}"
ios_path=$(echo "$content_ios" | jq -r '.html_path')
echo "IOS_PATH=$ios_path" >> "$GITHUB_OUTPUT"
cat > Mobile-Expensify/iOS/ExportOptions.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>method</key>
<string>ad-hoc</string>
<key>provisioningProfiles</key>
<dict>
<key>com.expensify.expensifylite.adhoc</key>
<string>(OldApp) AdHoc</string>
<key>com.expensify.expensifylite.adhoc.SmartScanExtension</key>
<string>(OldApp) AdHoc: Share Extension</string>
<key>com.expensify.expensifylite.adhoc.NotificationServiceExtension</key>
<string>(OldApp) AdHoc: Notification Service</string>
</dict>
</dict>
</plist>
EOF

- name: Rock Remote Build - iOS
id: rock-remote-build-ios
uses: callstackincubator/ios@79778c5739839044d2ca5af75ace7ba0467b5366 # v3
env:
GITHUB_TOKEN: ${{ github.token }}
IS_HYBRID_APP: true
with:
destination: device
re-sign: true
ad-hoc: true
scheme: 'Expensify AdHoc'
configuration: 'AdHoc'
certificate-file: './Certificates.p12'
provisioning-profiles: |
[
{
"name": "(OldApp) AdHoc",
"file": "./OldApp_AdHoc.mobileprovision"
},
{
"name": "(OldApp) AdHoc: Share Extension",
"file": "./OldApp_AdHoc_Share_Extension.mobileprovision"
},
{
"name": "(OldApp) AdHoc: Notification Service",
"file": "./OldApp_AdHoc_Notification_Service.mobileprovision"
}
]
comment-bot: false

postGithubComment:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -504,9 +518,9 @@ jobs:
DESKTOP: ${{ needs.desktop.result }}
IOS: ${{ needs.iosHybrid.result }}
WEB: ${{ needs.web.result }}
ANDROID_LINK: ${{ needs.androidHybrid.outputs.S3_APK_PATH }}
ANDROID_LINK: ${{ needs.androidHybrid.outputs.ROCK_APK_PATH }}
DESKTOP_LINK: https://ad-hoc-expensify-cash.s3.amazonaws.com/desktop/${{ inputs.APP_PULL_REQUEST_NUMBER }}/NewExpensify.dmg
IOS_LINK: ${{ needs.iosHybrid.outputs.IOS_PATH }}
IOS_LINK: ${{ needs.iosHybrid.outputs.ROCK_IOS_PATH }}
WEB_LINK: https://${{ inputs.APP_PULL_REQUEST_NUMBER }}.pr-testing.expensify.com

- name: Publish links to apps for download on Expensify/Mobile-Expensify PR
Expand All @@ -518,5 +532,5 @@ jobs:
GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
ANDROID: ${{ needs.androidHybrid.result }}
IOS: ${{ needs.iosHybrid.result }}
ANDROID_LINK: ${{ needs.androidHybrid.outputs.S3_APK_PATH }}
IOS_LINK: ${{ needs.iosHybrid.outputs.IOS_PATH }}
ANDROID_LINK: ${{ needs.androidHybrid.outputs.ROCK_APK_PATH }}
IOS_LINK: ${{ needs.iosHybrid.outputs.ROCK_IOS_PATH }}
Loading